[Portal] Smartcard plugin — Portal UI integration

[maxzaikin]

Summary

Add Smartcard enrollment and verification UI to the Blazor Portal.
Requires JavaScript interop for localhost WebSocket to Workstation Agent.

Context

See API-MFA — Smartcard section and
UI-Operator-Flow — Screen 4 (CRITICAL asset MFA)

Acceptance Criteria

• Settings → MFA → Admin-only smartcard enrollment section
  (only Admin can enroll cards for users)
• Enrollment screen: "Place card on reader" status indicator
  JavaScript interop connects to ws://localhost:7777
  Card UID displayed as "Card detected: MIFARE DESFire" (not raw UID)
  PIN input (4-8 digits, masked)
  Expiry date picker (optional)
• Card status indicator in user detail (Admin Users page)
• Checkout MFA screen for CRITICAL assets:
  Step 2 of 3 — "Place your smartcard on the reader"
  Card status: Waiting / Detected / Verified
  PIN input field appears after card detected
• Agent not running → graceful error:
  "Workstation Agent not found. Ensure it is installed and running."
  Link to installation instructions
• Plugin unavailable → 503 handled gracefully